> I read an analogy that pinning this on "cyber security" is like accusing a mugging victim of having a lack of personal security guards. That's just not how civil society works

Civil society does punish businesses when bad things happen due to negligence. Especially when the result of the negligence negatively effects someone else.

I think of it more like someone's house getting robbed because of them having bad or no locks¯\_(ツ)_/¯

I don't think the analogy fits because there are so many ways for an attacker to compromise a system besides the "front door". If we want to stretch things, a member of your own family can unwittingly let a guest perform an action that enables the robbery weeks later.

> That's just not how civil society works.

This is a cope and also irrelevant.

Civil society works a certain way because of its social interaction dynamics. The internet works much differently (namely, retribution is much harder, which rules out most tit-for-tat transgression management strategies, and the scale is much larger than is possible with human interaction).

A better analogy would be an armored truck full of cash parking overnight in a bad neighborhood with the doors unlocked, then crying to the media about how they were robbed by criminals. There has to be some level of personal responsibility; it's foolish to expect people to not do bad things just because the law says they shouldn't.

> it's foolish to expect people to not do bad things just because the law says they shouldn't

The parent comment:

> Minimum safety standards: laws and ability to enforce them.

So it's not just the law but also the potential for repercussions, of which there are currently zero.